AZ-104 Implement and Manage Virtual Networking Practice Question
A storage account must be reachable only from one subnet. The team does not want to deploy a private endpoint or manage private DNS zones, and they are acceptable with the storage account continuing to use its public endpoint. Which feature should be configured on the subnet?
⚠ Common exam trap
A common mix-up: candidates confuse service endpoints with private endpoints, assuming that restricting access to a subnet requires a private IP, when service endpoints achieve the same goal using the public endpoint with subnet-level firewall rules.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A service endpoint for Microsoft.Storage
A service endpoint for Microsoft.Storage allows a subnet to restrict access to a storage account's public endpoint without deploying a private endpoint or managing private DNS zones. When enabled, Azure adds the subnet's identity to traffic from that subnet, and the storage account's firewall can be configured to allow only that specific subnet, keeping the public endpoint active.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A private endpoint for the storage account
Why it's wrong here
A private endpoint deploys a NIC with a private IP address from your VNet into the storage account's private link, and it requires Private DNS Zone integration for resolution. The question explicitly says you do not want to deploy a private IP, so this option violates the stated requirement. Additionally, private endpoints are typically for scenarios where traffic must never leave the Microsoft backbone and you need to eliminate the public endpoint entirely, which is heavier than a simple subnet-to-service access rule.
When this WOULD be correct
If the question required the storage account to be accessible only from a subnet using a private IP address and without using the public endpoint, and the team was willing to manage private DNS zones, then a private endpoint would be the correct answer.
- ✓
A service endpoint for Microsoft.Storage
Why this is correct
A service endpoint allows the selected subnet to access the storage service over the Azure backbone while the service keeps its public endpoint. It fits the requirement to avoid private DNS and private IP deployment.
- ✗
A route table with a default route to the storage account
Why it's wrong here
A route table with a user-defined route controls the next hop for traffic (e.g., forcing all defaults to a virtual appliance or network virtual appliance), but it is incapable of granting or denying access at the storage service's firewall layer. Adding a default route to the storage account's IP prefix would only change how packets are directed, not whether the service accepts them from your subnet. The storage account's public endpoint will still evaluate its network rules and will deny any source subnet that is not explicitly allowed, regardless of routing changes.
When this WOULD be correct
This option would be correct in a scenario where the goal is to force all outbound traffic from the subnet to the storage account through a specific path, such as a firewall or network virtual appliance, for inspection or logging purposes, without requiring subnet-level access restrictions.
- ✗
An application security group containing the subnet
Why it's wrong here
An application security group is a logical grouping of VM NICs referenced in network security group rules to control north-south or east-west traffic between VMs, not a construct for authorizing access to a managed service like Azure Storage. Storage account network rules accept source IP addresses or virtual network subnets, but they have no concept of an ASG identity. Placing a subnet in an ASG would have zero effect on the storage firewall; you still need a service endpoint or listed subnet rule to allow the traffic.
When this WOULD be correct
In a scenario where you need to apply NSG rules to a group of VMs based on their application tier (e.g., web servers, database servers), and you want to simplify rule management by using ASGs instead of individual IP addresses or subnets.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓A service endpoint for Microsoft.StorageCorrect answer▾
Why this is correct
A service endpoint allows the selected subnet to access the storage service over the Azure backbone while the service keeps its public endpoint. It fits the requirement to avoid private DNS and private IP deployment.
✗A private endpoint for the storage accountWrong answer — click to see why▾
Why this is wrong here
The question explicitly states the team does not want to deploy a private endpoint or manage private DNS zones, and they are acceptable with using the public endpoint. A private endpoint would require a private endpoint resource and private DNS zones, contradicting these constraints.
★ When this WOULD be the correct answer
If the question required the storage account to be accessible only from a subnet using a private IP address and without using the public endpoint, and the team was willing to manage private DNS zones, then a private endpoint would be the correct answer.
Why candidates choose this
Candidates may confuse service endpoints with private endpoints, or think that private endpoints are the only way to restrict network access to a subnet, overlooking that service endpoints can achieve subnet-level restriction without private IPs.
✗A route table with a default route to the storage accountWrong answer — click to see why▾
Why this is wrong here
A route table with a default route to the storage account does not restrict access to a specific subnet; it only controls network traffic routing, not access control. The storage account's public endpoint would still be accessible from any subnet, failing the requirement to limit access to one subnet.
★ When this WOULD be the correct answer
This option would be correct in a scenario where the goal is to force all outbound traffic from the subnet to the storage account through a specific path, such as a firewall or network virtual appliance, for inspection or logging purposes, without requiring subnet-level access restrictions.
Why candidates choose this
Candidates may confuse routing with access control, thinking that adding a route to the storage account's IP range would somehow restrict access to only that subnet, or they may overestimate the role of route tables in network security.
✗An application security group containing the subnetWrong answer — click to see why▾
Why this is wrong here
An application security group (ASG) is used to group virtual machines by application roles for network security group (NSG) rules, not to restrict storage account access to a specific subnet. It does not provide network-level access control to Azure PaaS services like storage accounts.
★ When this WOULD be the correct answer
In a scenario where you need to apply NSG rules to a group of VMs based on their application tier (e.g., web servers, database servers), and you want to simplify rule management by using ASGs instead of individual IP addresses or subnets.
Why candidates choose this
Candidates may confuse ASGs with service endpoints or think that ASGs can be used to restrict network traffic to Azure services, similar to how NSGs can filter traffic to VMs.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Privileged Identity Management (PIM)
Key term
Private endpoint
A private endpoint is a network interface that securely connects a service over a private IP address inside a virtual network, keeping traffic off the public internet.
Key term
Storage account
A cloud storage account is a container that holds a set of cloud storage services and their data, providing a unique namespace and access policies for storing and managing unstructured data.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.